New FalconSubmission

New-FalconSubmission

SYNOPSIS

Submit a sample to the Falcon Intelligence Sandbox

DESCRIPTION

'Sha256' values are retrieved from files that are uploaded using 'Send-FalconSample'. Files must be uploaded before they can be provided to the Falcon Intelligence Sandbox.

Requires 'Sandbox (Falcon Intelligence): Write'.

PARAMETERS

Name	Type	Min	Max	Allowed	Pipeline	PipelineByName	Description
EnvironmentId	String			android macOS_10.15 ubuntu16_x64 win7_x64 win7_x86 win10_x64			Analysis environment
Sha256	String						Sha256 hash value
Url	String						A webpage or file URL
SubmitName	String						Submission name
ActionScript	String			default default_maxantievasion default_randomfiles default_randomtheme default_openie			Runtime script for sandbox analysis
CommandLine	String						Command line script passed to the submitted file at runtime
SystemDate	String						A custom date to use in the analysis environment
SystemTime	String						A custom time to use in the analysis environment
DocumentPassword	String						Auto-filled for Adobe or Office files that prompt for a password
NetworkSetting	String			default tor simulated offline			Network settings to use in the analysis environment
EnableTor	Boolean						Route traffic via TOR
UserTag	String[]						Tags to categorize the submission

SYNTAX

New-FalconSubmission [-EnvironmentId] <String> [[-Sha256] <String>] [[-Url] <String>] [[-SubmitName] <String>] [[-ActionScript] <String>] [[-CommandLine] <String>] [[-SystemDate] <String>] [[-SystemTime] <String>] [[-DocumentPassword] <String>] [[-NetworkSetting] <String>] [[-EnableTor] <Boolean>] [[-UserTag] <String[]>] [-WhatIf] [-Confirm] [<CommonParameters>]

SDK Reference

falconpy

Submit

USAGE

Submit an uploaded sample for analysis in a sandbox environment

The file submitted to the Falcon Intelligence Sandbox must be previously uploaded through Send-FalconSample.

New-FalconSubmission -Sha256 <sha256> -EnvironmentId win7_x86 -SubmitName virus.exe

See Send-FalconSample.

2022-10-24: PSFalcon v2.2.3